Detect Azure Resource Manager templates and Bicep-equivalent ARM JSON that create Microsoft.Authorization/roleAssignments resources whose effective scope is the entire subscription or a management group, then report findings and metrics with remediation guidance to move assignments to narrower resource-group or resource scopes where possible.
Detect Azure Resource Manager templates and Bicep-equivalent ARM JSON that create Microsoft.Authorization/roleAssignments resources whose effective scope is the entire subscription or a management group, then report findings and metrics with remediation guidance to move assignments to narrower resource-group or resource scopes where possible.
This package is read-only. It does not rewrite source files.
Installation
bash
# Install from registry
npx codemod run @codemod/arm-role-assignment-broad-scope-audit
# Or run locally
pnpm dlx codemod@latest workflow run -w workflow.yaml -t <target-repo>
Usage
The codemod scans ARM JSON deployment templates for deployable Microsoft.Authorization/roleAssignments resources and reports one finding per role assignment whose effective scope is:
The entire subscription
A management group
It classifies findings by scope source:
explicitScopeProperty
inheritedTargetScope
extensionResourceTarget
resourceIdHelper
literalResourceId
It deterministically evaluates common ARM expressions used to build scope ids, including:
subscription()
subscriptionResourceId()
managementGroupResourceId()
extensionResourceId()
resourceId() when the base scope can be resolved statically
tenantResourceId()
format() and concat() when all inputs are deterministic
It excludes:
ARM parameter files
Non-template JSON
Role assignments narrowed to a resource group or specific resource
Cases whose scope cannot be resolved statically
Each finding includes the file path, JSON path, resource name expression, effective scope classification, scope source, normalized roleDefinitionId when available, evidence, and remediation guidance.
Prefer RBAC assignments at resource-group or individual-resource scope. Keep subscription or management-group assignments only when organization-wide administration is explicitly intended, documented, and reviewed.
Development
bash
# Test the analysis codemod
pnpm test
# Validate the workflow
pnpm dlx codemod@latest workflow validate -w workflow.yaml
# Publish to registry
pnpm dlx codemod@latest login
pnpm dlx codemod@latest publish
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.